v0.10.0 — API Admin + Modern-Dark Theme + AI Docs

Highlights

apps/api/ — REST surface health + threat detection

A new app parallel to apps/mcp/ that observes the REST API surface. Includes:

• /smallstack/api/ — Health admin page with 9 color-coded checks (OpenAPI validity, endpoint registry, URL conf, Swagger/ReDoc shells, orphan files, token auth, etc.) and a Run Self-Test button that mints a temp readonly token, hits the discovery endpoints, and revokes.
• /smallstack/api/activity/ — Operational view with three regions: top endpoints by hit count, threat panel (6 detectors: axes lockouts, auth-failure burst, path scanning, request bursts, scanner user-agents, revoked-token use), and a filterable RequestLog table.
• python manage.py api_doctor — CLI mirror of the Health page with --json, --explain, --check-only, --no-self-test flags.
• Dashboard widget — surfaces endpoint count + high-severity threat count on /smallstack/. Status flips to degraded on active threats or orphan files.

Modern-dark theme

A coordinated refresh across all five palettes (Django/default, Blue, Purple, Orange, Contrast). Replaces the legacy warm-gray surfaces (#212121 cards, Django brand teal accent) with a cohesive modern-black canvas + vibrant Tailwind-style accent pattern (Linear / Vercel / Anthropic console aesthetic).

Palette	Accent	Surface
Django (default)	#10b981 emerald	#131722 (strong cool bias — emerald's complement is red)
Blue	#3b82f6 blue	#161b22 (GitHub Dark)
Purple	#a855f7 purple	#161b22
Orange	#f97316 orange	#161b22
Contrast	#ffffff white	#1a1a1a (pure neutral, accessibility-tuned)

New --accent-band-bg CSS variable controls hero band tint — defaults to a subtle accent mix; overridden to neutral for orange/django/high-contrast (where their accents produce muddy brown/olive at low lightness).

Fixed a long-standing bug where the django (default) palette never got its data-palette attribute set, so its overrides never matched and pages fell back to the legacy warm-gray rules. The blocking script in base.html and setPalette() in theme.js now always set the attribute.

AI-discoverability docs

The motivating problem: when downstream projects clone smallstack and the user builds with AI assistance, the AI tends to hard-code hex literals that lock pages to legacy warm-gray and break the modern palettes. Users reported spending serious effort post-fixing AI-built pages.

New canonical guidance that travels with every clone:

• docs/skills/modern-dark-theme.md (~440 lines) — the "before building a page, read this" skill. Patterns + anti-patterns + decision tree.
• docs/skills/modify-palettes.md (~250 lines) — file map + 4-step walkthrough + color-science gotchas for adding/tuning palettes.
• apps/smallstack/docs/theme-architecture.md (~190 lines) — design philosophy + variable cascade + color science.
• CLAUDE.md (NEW, in-repo) — 11-section vibe-coder orientation. Names the anti-patterns up front, points at modern-dark-theme.md as required reading.

Plus updates to theming.md, theme-color-reference.md (current values per palette), and the skills README index.

CLI reference

• apps/smallstack/docs/cli-reference.md — every manage.py command + Make target + system tool with options and examples.
• docs/skills/cli-tools.md — task → tool / failure → tool / tool → docs decision tree for agents.

Stats

• 41 new tests (775 passing, was 734)
• Lint clean (make lint)
• No new dependencies
• No migrations required

Upgrading

git pull origin main
make migrate   # no-op, here for safety
make test

For downstream projects (smallstack_web, opshugger, external clones), pulling main applies the modern-dark surfaces automatically. If your project has custom templates with hard-coded hex literals (#1e1e1e, #3a3a3a, etc.), they'll continue to render legacy warm-gray on those pages — see docs/skills/modern-dark-theme.md for the conversion patterns.

Full changelog

See the commit log between v0.9.2 and v0.10.0.